Sysinternals Suite

Sysinternals Suite Januar 2024

ProcDump v11.0

This update to ProcDump, a command-line utility for generating memory dumps from running processes, adds ModuleLoad/Unload and Thread Create/Exit triggers, removes Internet Explorer JavaScript support, and improves descriptive text messages.

ProcDump 1.3 for Linux

This update to ProcDump for Linux changes the CLI interface to match ProcDump for Windows, and adds a new process group trigger (-pgid) to allow monitoring all processes running in the same process group.

Process Explorer v17.01

This update to Process Explorer fixes a crash when right-clicking an empty area of the lower pane threads tab and improves menu rendering.
Process Explorer v17.0

This update to Process Explorer, an advanced process, DLL and handle viewing utility, adds dark theme support, multipane view in the main window with a new threads pane, startup performance optimization and more.

Handle v5.0

This update to Handle, a tool that displays information about open handles for any process in the system, adds CSV output with a new -v switch and has an option to print the granted access mask with -g.

Process Monitor v3.92

This update to Process Monitor, a utility for observing in real time file system, Registry, and process or thread activity, adds a command-line option for setting the filter driver’s altitude.

Sysmon v14.11

This update to Sysmon, an advanced host monitoring tool, fixes a bug preventing FileDeleteDetected events reporting and adds support for ARM64.
  • ZoomIt v6.11
    • This update to ZoomIt fixes a crash with right-justified text input and improves multiline text handling.
  • ZoomIt v6.1
    • This update to ZoomIt, a screen magnification and annotation tool, adds right-justified text input, an option to scale the screen recordings resolution, and usability fixes.
Sysmon v14.1

This update to Sysmon, an advanced host monitoring tool, adds a new event type, FileBlockShredding that prevents wiping tools such as Sysinternals SDelete from corrupting and deleting files.

Coreinfo v3.6

This update to Coreinfo, a utility that reports system CPU, memory and cache topology and information, now has an option (-d) for measuring inter-CPU latencies in counter ticks.

AccessEnum v1.35

This update to AccessEnum, a tool that summarizes account permissions on files and folders, fixes a version number mismatch in its version information.

BgInfo v4.32

This update to BgInfo, a tool for displaying system information on screen desktop, correctly reports Windows 11 Insider versions.

NotMyFault v4.21

This update to NotMyFault, a tool used to crash, hang, and cause kernel memory leaks on Windows, now works on ARM64 systems.
Sysmon v14.0

This major update to Sysmon, an advanced host monitoring tool, adds a new event type, FileBlockExecutable that prevents processes from creating executable files in specified locations. It also includes several performance improvements and bug fixes.

AccessEnum v1.34

AccessEnum, a tool for enumerating file system and registry permissions, now supports paths longer than MAX_PATH characters.

Coreinfo v3.53

This update to Coreinfo, a utility that reports system CPU, memory and cache topology and information, now handles NUMA nodes with more than 64 processors.
ZoomIt v6.01

This release for ZoomIt fixes a 32 bit bug.

BgInfo v4.31

This release for BgInfo fixes a 32 bit crash.

ProcMon v3.91

This release for Process Monitor fixes an ARM64 driver load error.
ZoomIt v6.0

This major update to ZoomIt, a screen magnification and annotation tool, adds built-in screen recording for easy demo recordings, and now supports Unicode typing input.

BgInfo v4.30

This update to BgInfo, a tool for writing various system information to the desktop wallpaper, now correctly reports Windows 11 and Windows Server 2022 versions.

PsExec v2.40

This update to PsExec, a command line utility for remotely launching processes on Windows computers, adds a new option, -g, for selecting the processor group.

ProcMon v3.90

This Process Monitor update improves event list filtering performance.

Sigcheck v2.90

Sigcheck, a command-line utility that shows file version, timestamp and signatures, now supports custom code integrity policy file checks.
AccessChk v6.15

This update for AccessChk, a tool that shows what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services, fixes a crash with passing long strings on the command line. Parameters previously limited to MAX_PATH characters have no length restrictions now.

RAMMAp v1.61

This update for RAMMap, a utility that analyzes and displays physical memory usage, fixes problems with the processes tab under Windows 11 and improves the UI on scaled displays.

Sysmon v13.34

This Sysmon update improves performance for UDP network event tracing (the NetworkConnect global option), solves a rare system hang (blue screen) when monitoring ProcessCreate events and a memory/handle leak on ImageLoad events with several exclude clauses.
Autoruns v14.09

This Autoruns update fixes a bug preventing the enabling/disabling of startup folder items.

Process Monitor v3.89

This Process Monitor update fixes a crash related to context menus.

Sysmon v13.33

This Sysmon update fixes a crash occurring on Windows Server 2012 and improves memory handling for the service.

ZoomIt v5.10

This update to ZoomIt, a screen magnification and annotation tool, now supports pen and touch drawing.
ZoomIt v5.0

ZoomIt, a screen zoom and annotation tool, now supports Windows 11 and antialiased line drawing. Note that under Windows 11 and Windows Server 2022 some UI elements might not react to mouse clicks when zoomed. The temporary workaround until a future Windows update is to store the ZoomIt executable under the Windows or the Program Files directories.

RDCMan v2.90

RDCMan, a tool for managing and connecting to Remote Desktop sessions, receives support for Restricted Admin (/restrictedAdmin from mstsc) and Remote Credential Guard (/remoteGuard from mstsc) and bug fixes.

Autoruns v14.08

This Autoruns update fixes a series of application crashes, now correctly parses paths with spaces passed as command line arguments and improves .arn import functionality.

Process Monitor v3.88

This Process Monitor update mitigates a rare program crash condition.

TCPView v4.17

This TCPView update fixes a crash related to filtering by TCP version.

VMMap v3.32

VMMap, a tool that reports the virtual memory layout of a process, now supports Windows 11.

Sysmon v13.32

This Sysmon update fixes a conflict with FileDelete and FileDeleteDetected events in the same config.

WinObj v3.14

This WinObj update makes the behavior of the object tree control more consistent with Windows when handling right clicks.
Oben Unten